SC-900 Practice Exam 57 — 20 Questions

Question 1

A company uses Microsoft Purview Compliance Manager to improve their compliance posture. They are preparing for a SOC 2 audit and need to score compliance with SOC 2 controls, track improvement actions, and assign tasks to responsible teams. Which component of Compliance Manager should they use to assign and track specific actions to improve their compliance score?

Accepted Answer

Improvement action. Improvement actions in Compliance Manager are the specific, actionable tasks that directly impact your compliance score. They represent the steps you need to take (e.g., configuring a policy, enabling logging) to satisfy a control. By assigning these actions to responsible teams and tracking their completion status, you can systematically improve your score and demonstrate progress during a SOC 2 audit.

Answer

Assessment

Answer

Control

Answer

Template

Question 2

A compliance officer needs to investigate a potential data exfiltration incident. They must search the unified audit log for all activities where users accessed a specific sensitive SharePoint site in the last 7 days. Additionally, they need to create a custom alert that triggers when more than 10 file downloads occur from that site within an hour. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit (Standard). Microsoft Purview Audit (Standard) logs all user activities, including file accesses and downloads from SharePoint sites, for 90 days. The compliance officer can search the unified audit log for the specific site's activities over the last 7 days and create custom alert policies (e.g., threshold-based alerts for >10 downloads per hour) using the Microsoft 365 Defender portal. This makes Audit (Standard) the correct solution for both investigation and alerting.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Communications Compliance

Question 3

A compliance officer wants a central dashboard to assess the organization's compliance posture against regulatory standards such as GDPR and ISO 27001. They need actionable recommendations to improve their compliance score and track progress over time. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct solution because it provides a central dashboard that assesses an organization's compliance posture against regulatory standards like GDPR and ISO 27001, offers actionable recommendations to improve the compliance score, and tracks progress over time through continuous assessments and improvement actions.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit

Question 4

A compliance officer needs to retain customer records for 7 years and then automatically delete them. However, during an ongoing legal case, the legal team must preserve specific documents indefinitely without affecting the retention policy for other documents. Which combination of Microsoft Purview solutions should the company use?

Accepted Answer

Data Lifecycle Management and eDiscovery. Data Lifecycle Management (DLM) allows you to define retention policies (e.g., 7 years) and then automatically delete data at the end of that period. eDiscovery (specifically, eDiscovery holds) lets you place a legal hold on specific documents, preserving them indefinitely without altering the broader retention policy. Together, they meet both the automatic deletion requirement and the need to preserve documents during litigation.

Answer

Records Management and Audit

Answer

Information Protection and Data Loss Prevention

Answer

Communication Compliance and Insider Risk Management

Question 5

A company uses Microsoft Defender for Endpoint. An alert indicates that a device is communicating with a known malicious IP address. The security team wants to automatically block the IP address on all devices. Which action should they configure?

Accepted Answer

Indicator of compromise (IoC). Option B is correct because an indicator of compromise (IoC) in Defender for Endpoint can be used to block IP addresses. Option A is wrong because an automated investigation can resolve alerts but does not block IPs. Option C is wrong because a custom detection rule is for query-based detections. Option D is wrong because a threat analytics report provides threat intelligence but does not take action.

Answer

Custom detection rule

Answer

Automated investigation

Answer

Threat analytics report

Question 6

A government agency has extremely sensitive classified data that must be protected even from Microsoft. They require a solution where the encryption keys are stored and managed on-premises within their own hardware security module (HSM), ensuring that Microsoft cannot decrypt their data. Which Microsoft Purview solution should they implement?

Accepted Answer

Microsoft Purview Customer Key. Microsoft Purview Customer Key is the correct solution because it allows customers to provide and manage their own encryption keys using a hardware security module (HSM) on-premises. This ensures that Microsoft cannot access the encrypted data, as the keys are stored outside of Microsoft's control, meeting the requirement for protecting classified data even from Microsoft.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Communication Compliance

Question 7

A healthcare organization must comply with HIPAA. They need to automatically detect protected health information (PHI) in emails sent from Exchange Online, prevent users from sharing these emails with unauthorized external recipients, and apply a retention label that retains PHI emails for six years. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Information Protection and Data Loss Prevention. Microsoft Purview Information Protection and Data Loss Prevention (DLP) is the correct solution because it combines sensitive data classification (to detect PHI via built-in HIPAA data classifiers) with policy-based enforcement (to block sharing with unauthorized external recipients) and can automatically apply a retention label (via auto-labeling policies) to retain PHI emails for six years. This directly addresses all three requirements: detection, prevention, and retention.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Insider Risk Management

Question 8

A large enterprise is concerned about insider threats. The compliance team needs to detect and investigate potential data theft scenarios, such as when employees nearing their resignation date suddenly copy large amounts of sensitive data to USB drives or email confidential files to personal accounts. They require a solution that uses machine learning to identify risky activities and create alerts for investigation. Which Microsoft Purview solution should they deploy?

Accepted Answer

Insider Risk Management. Insider Risk Management is the correct solution because it uses machine learning to correlate signals from user activities (e.g., copying files to USB, emailing to personal accounts) with contextual indicators like resignation dates, enabling detection of potential data theft scenarios. It provides built-in alerting and investigation workflows specifically designed for insider threat use cases, unlike the other options which focus on retention, auditing, or compliance posture.

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Answer

Compliance Manager

Question 9

A legal team is involved in a lawsuit and needs to ensure that all emails and documents related to the case are preserved in their original state, even if users edit or delete them. They also need the ability to search for these items and export them for legal review. Which Microsoft Purview solution should the compliance team configure to meet these requirements?

Accepted Answer

Microsoft Purview eDiscovery (Standard). Microsoft Purview eDiscovery (Standard) is the correct solution because it provides the ability to place a legal hold on content (preserving emails and documents in their original state even if users edit or delete them), perform searches across Exchange Online, SharePoint Online, OneDrive for Business, and Teams, and export the results for legal review. This directly meets the requirements of preservation, search, and export for litigation.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit (Standard)

Question 10

A company uses Microsoft Defender for Cloud to secure its hybrid cloud environment. They need to continuously assess compliance with regulatory standards like ISO 27001 and receive recommendations for remediation. Which feature should they enable?

Accepted Answer

Defender for Cloud’s regulatory compliance dashboard. Microsoft Defender for Cloud's regulatory compliance dashboard provides continuous assessments against standards like ISO 27001 and offers recommendations. Secure Score is a security posture metric. Defender plans are for workload protection. Workload protections are specific to resources.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Answer

Defender for Cloud’s Secure Score

Question 11

An organization's security team needs to investigate a security incident that occurred two months ago. They need to search the unified audit log for specific activities performed by a user, such as file access, email actions, and sign-in events, to understand the scope of the compromise. Which Microsoft Purview solution provides these audit log search capabilities?

Accepted Answer

Microsoft Purview Audit. Microsoft Purview Audit (specifically Audit (Standard) or Audit (Premium)) provides the ability to search the unified audit log for activities like file access, email actions, and sign-in events. This solution is designed for forensic investigation of user and admin activity within Microsoft 365, making it the correct choice for investigating a security incident that occurred two months ago.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Question 12

An organization wants to automatically retain emails for 7 years and then delete them. They also need to place a legal hold on specific users' mailboxes to preserve all emails during litigation. Which combination of Microsoft Purview features should they use?

Accepted Answer

Retention policies and Litigation Hold. For automatic retention and deletion, Retention policies in Microsoft Purview are ideal as they apply to entire mailboxes. To preserve emails for litigation, Litigation Hold can be enabled on specific user mailboxes, ensuring that no emails are deleted or altered. The combination of these two features meets both requirements.

Answer

Retention labels and eDiscovery

Answer

Data Lifecycle Management and Audit

Answer

Records Management and Data Loss Prevention

Question 13

A company must retain all customer contracts for 10 years to comply with industry regulations. After 10 years, the contracts must be permanently deleted. Which Microsoft Purview solution should be used to automate this process?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (DLM) in Microsoft Purview is the correct solution because it allows you to define retention labels and policies that automatically retain contracts for a specified period (10 years) and then trigger a permanent deletion disposition review or direct deletion. This aligns directly with the regulatory requirement to retain data for a fixed duration and then dispose of it securely.

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Answer

Information Protection

Question 14

A company has a policy that prohibits employees from sharing confidential customer data with unauthorized parties. The compliance team needs to detect patterns of unusual user activity that may indicate insider data theft, such as downloading large volumes of data to a personal device or emailing sensitive files to external recipients. They also want to investigate the activity and take remediation actions like generating a case for litigation or notifying the user's manager. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is designed specifically to detect, investigate, and remediate insider data theft scenarios. It uses predefined and customizable policies to identify patterns like large-volume downloads to personal devices or emailing sensitive files externally, and provides built-in remediation actions such as generating a case for litigation or notifying a user's manager.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Question 15

A financial services company is subject to regulations that require monitoring of employee communications for potential market manipulation. The compliance team needs to create policies that automatically detect messages containing phrases like 'insider info' or 'confidential trade' in Microsoft Teams chats and Exchange Online emails. Detected messages should be routed to designated reviewers for investigation, and the company wants a built-in Microsoft Purview solution to handle this process. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect and investigate policy violations in organizational communications, such as Microsoft Teams chats and Exchange Online emails. It allows compliance teams to create custom policies that automatically scan for sensitive phrases like 'insider info' or 'confidential trade' and route flagged messages to designated reviewers for investigation, meeting the regulatory monitoring requirements.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management

Question 16

A security team needs to investigate a potential data leak where an employee may have emailed sensitive customer information to a competitor. They want to search the unified audit log for specific email activities, such as 'Send' or 'Forward', and generate a detailed report. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit (Standard or Premium). Microsoft Purview Audit (Standard or Premium) is the correct solution because it captures and logs specific email activities such as 'Send' and 'Forward' from Exchange Online. The security team can search the unified audit log for these operations and export a detailed report for investigation. Compliance Manager, DLP, and eDiscovery do not provide this direct audit log search capability for individual email actions.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview eDiscovery (Premium)

Question 17

A company has a SharePoint Online library containing legal contracts. They must satisfy a regulatory requirement that contracts cannot be modified or deleted after they are signed. Additionally, they need to retain the contracts for 10 years after the contract end date, after which they can be disposed of manually. Which Microsoft Purview solution should they implement?

Accepted Answer

Records Management. Records Management in Microsoft Purview allows you to declare items as records, which locks them against modification or deletion (meeting the 'cannot be modified or deleted' requirement). It also supports event-based retention, enabling you to start a 10-year retention period from the contract end date and then allow manual disposal after that period expires.

Answer

Sensitivity labels

Answer

Data Loss Prevention (DLP) policy

Answer

Data Lifecycle Management

Question 18

A company is subject to a legal hold for an ongoing investigation. The IT administrator must prevent the deletion of any documents related to this case across SharePoint Online and OneDrive, overriding any existing deletion policies. Which Microsoft Purview capability should the administrator use?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct choice because it provides legal hold capabilities that can preserve content in SharePoint Online and OneDrive for Business, overriding any deletion policies. When a legal hold is applied via eDiscovery, the system places a hold on the specified locations, preventing permanent deletion or modification of documents until the hold is released. This directly addresses the requirement to prevent deletion of case-related documents during an ongoing investigation.

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Answer

Communication Compliance

Question 19

A company uses Microsoft 365 and needs to comply with a regulatory requirement to retain all customer contracts for 5 years after the contract's end date, after which they must be automatically deleted. Additionally, the legal department needs the ability to preserve all documents related to an ongoing lawsuit, overriding any deletion timelines. Which Microsoft Purview solution should the company use?

Accepted Answer

Data Lifecycle Management with retention labels and eDiscovery holds. Data Lifecycle Management (DLM) with retention labels allows the company to apply a retention label to customer contracts that retains them for 5 years after the contract end date and then automatically deletes them. eDiscovery holds can be placed on all documents related to an ongoing lawsuit, which overrides any deletion timelines, ensuring that content is preserved until the hold is released. This combination directly meets both the regulatory retention and legal preservation requirements.

Answer

Information Barriers

Answer

Communication Compliance

Answer

Audit (Premium)

Question 20

A company needs to ensure that employees cannot share sensitive financial reports with external parties via email. They want to automatically detect and block emails that contain the phrase 'Confidential-Financial' in the subject line or body, regardless of the recipient's domain. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and automatically block sensitive content—such as the phrase 'Confidential-Financial'—in emails, regardless of the recipient's domain. DLP policies can inspect subject lines and body text, then enforce actions like blocking delivery or notifying the user, making it ideal for preventing unauthorized external sharing of financial reports.

Answer

Information Protection (sensitivity labels)

Answer

Data Lifecycle Management (retention policies)

Answer

Audit